Privacy Policy
v2.0 · Updated: 2026-09-22
§1. Who processes your data
If you represent a tenant organisation (employer):
The controller of your data is your organisation (the employer). The processor is SIA "Workvin", which processes the data on the instructions of your employer.
For data that Workvin collects on its own behalf (billing, security, analytics):
Controller — SIA "Workvin", reg. No. 44103125090, VAT LV44103125090, Stiebru iela 1-50, Rīga, LV-1015, Latvia. Contact for data-protection matters: support@workvin.app
§2. Who this policy is for
This policy is addressed to:
- Employees of tenant organisations that use Workvin.
- Tenant representatives (HR, managers).
- Visitors of the workvin.app website.
§3. Purposes and legal bases of processing
| Purpose | Legal basis | Data categories |
|---|---|---|
| Working-time recording | Art. 6(1)(b) — performance of a contract; Art. 6(1)(c) — legal obligation (Darba likums / TLS / DK) | Name, position, clock-in/out times |
| GPS verification of a clock event | Art. 6(1)(a) — consent | GPS coordinate at the moment of the event |
| Photo at a clock event | Art. 6(1)(a) — consent | Photo |
| Biometric identification | Art. 9(2)(a) — explicit consent | Biometric template |
| HR management | Art. 6(1)(b) + Art. 6(1)(c) | HR data, documents |
| Platform security | Art. 6(1)(f) — legitimate interest | Audit logs, IP, security events |
| Technical support | Art. 6(1)(f) — legitimate interest | Error logs (anonymised) |
| Billing (for tenants) | Art. 6(1)(b) + Art. 6(1)(c) | Tenant billing data |
| Email notifications | Art. 6(1)(a) — consent; Art. 6(1)(b) for employment-related notices | Email address |
Workvin's legitimate interest (Art. 6(1)(f)): security monitoring of the SaaS platform, fraud prevention, service stability. This interest does not override the rights of data subjects (right to object — §7). A legitimate-interest assessment (LIA) has been carried out for each Art. 6(1)(f) basis and is available on request.
Note on consent in the employment context (Art. 7 GDPR, EDPB Guidelines 05/2020, Opinion 2/2017). For consent-based features (GPS, photo, biometrics), consent is given by the employer-controller on behalf of the data subject within the employment relationship. Given the "employer–employee" imbalance, the validity of consent as a basis may be challenged; therefore the following are mandatory: (1) an equivalent alternative without penalties, (2) no coercion, (3) free withdrawal (Art. 7(3)).
Source of data (Art. 14 GDPR). Some data is received by Workvin not directly from the data subject but from the employer-controller (identity, HR data, timesheets). The Art. 14 GDPR disclosures apply to such data, and this policy provides them.
§4. Categories of recipients
We keep the number of recipients of personal data to a minimum. Categories of recipients:
- Infrastructure/hosting provider located in the EU — operation of the service.
- Push-notification providers — delivery of mobile notifications; they may be located outside the EU (see §5). Push payloads contain only neutral event identifiers — no personal data is transferred in the push payload.
- Competent authorities — disclosure only where required by law and only to the extent provided by law.
Workvin does not sell personal data and does not share it for advertising purposes. Tenant organisations receive the full, named list of sub-processors in their Data Processing Agreement (DPA); to request it, write to support@workvin.app.
§5. Cross-border transfers
Some push-notification providers may be located outside the EU (e.g. in the USA). Legal transfer mechanisms (Chapter V GDPR, Art. 44–49):
- Adequacy — EU-US Data Privacy Framework (DPF) (European Commission decision of 10.07.2023, Art. 45 GDPR) — for recipients certified under the DPF;
- EU Standard Contractual Clauses (SCC, Decision 2021/914, Art. 46(2)(c)) — for non-certified recipients and as a fallback for DPF-certified ones;
- for each SCC transfer a transfer impact assessment (TIA) has been carried out and additional measures adopted in light of the CJEU C-311/18 ruling (Schrems II): encryption in transit (TLS 1.2+), payload minimisation.
Push notifications contain only neutral event identifiers — no personal data is transferred in the push payload.
§6. Retention periods
| Data category | Retention period |
|---|---|
| Working-time records | LV: 5 years; EE: 7 years; LT: 5 years from the date of the record |
| HR documents / employment contracts | Up to 10 years after the end of employment |
| User account | Deleted 3 months after termination of the contract |
| GPS data | 6 months (or immediately on withdrawal of consent) |
| Clock-event photos | 6 months (or immediately on withdrawal) |
| Audit logs | 3 years (then anonymised) |
| Error tracking | 21 days |
| Product analytics | 12 months |
| Billing documents | LV/LT: 5 years; EE: 7 years |
| Consent records | 5 years after withdrawal / end of the relationship |
§7. Your rights
You have the right to:
- Access (Art. 15): obtain a copy of your data.
- Rectification (Art. 16): correct inaccurate data.
- Erasure (Art. 17): the "right to be forgotten" — where there is no legal ground to retain the data.
- Restriction of processing (Art. 18): where accuracy or lawfulness is contested.
- Portability (Art. 20): receive your data in a machine-readable format.
- Objection (Art. 21): to processing based on legitimate interest.
- Withdrawal of consent: at any time, without affecting the lawfulness of processing before withdrawal.
How to make a request: email support@workvin.app. Response time: 30 days (+ 60 days where a justified extension applies).
§8. Right to lodge a complaint
You have the right to contact the supervisory authority of your place of residence:
| Country | Authority | Contact |
|---|---|---|
| LV | Datu valsts inspekcija | www.dvi.gov.lv · pasts@dvi.gov.lv |
| EE | Andmekaitse Inspektsioon | www.aki.ee · info@aki.ee |
| LT | Valstybinė duomenų apsaugos inspekcija | www.ada.lt · ada@ada.lt |
§9. Whether providing data is mandatory
Data required for working-time recording (name, position, times) is mandatory under labour law. Without it, use of the Service is not possible.
GPS, photo and biometrics are voluntary (based on consent). Refusal or withdrawal of consent does not entail any penalty from Workvin; consequences for the employment relationship are determined by your employer.
§10. Automated decision-making
Workvin does not carry out automated decision-making that significantly affects data subjects on the basis of their personal data (no profiling within the meaning of Art. 22 GDPR).
Controller: SIA "Workvin", reg. No. 44103125090, Stiebru iela 1-50, Rīga, LV-1015, Latvia · support@workvin.app